A federal judge in Seattle sentenced a 22-year-old U.S. Army soldier to 70 months in federal prison for orchestrating a series of sophisticated cyberattacks and extortion schemes targeting major global telecommunications providers and cloud storage platforms. Cameron John Wagenius, who operated under the cybercriminal alias "Kiberphant0m" while stationed at a military base in South Korea, was also ordered to pay $294,978 in restitution to his victims.
The sentencing marks a critical milestone in a multi-agency international investigation involving the Federal Bureau of Investigation (FBI), the Defense Criminal Investigative Service (DCIS), the U.S. Secret Service, and the Army Criminal Investigation Division (CID). Prosecutors revealed that despite orchestrating massive breaches that compromised sensitive metadata for more than 100 million AT&T customers and leaked proprietary information from dozens of corporate entities, Wagenius earned a meager $1,500 in direct profits from his illegal enterprises.
The case underscores the evolving nature of insider threats, the vulnerabilities inherent in cloud-based data repositories lacking robust multi-factor authentication (MFA), and the increasing intersection of military security clearances and cybercrime.
Chronology of the Cyberattacks and Extortion Campaign
The illicit operation orchestrated by Wagenius and his co-conspirators unfolded across several distinct phases, moving from initial cloud compromises to public extortion and subsequent federal apprehension.
- Early to Mid-2024: Wagenius, leveraging a U.S. Army secret clearance while stationed in South Korea, began utilizing exposed credentials on cloud data storage service Snowflake. Because several major corporate clients failed to enforce multi-factor authentication, the threat actors successfully downloaded vast troves of proprietary data.
- October 2024: Operating under the moniker "Kiberphant0m," Wagenius boasted on underground cybercrime forums about successfully stealing call and text metadata—including source numbers, destination numbers, timestamps, and durations—for tens of millions of AT&T customers. He claimed responsibility for hacking over a dozen global telecommunications companies, including Verizon’s Push-to-Talk business, subsequently launching public extortion campaigns against them.
- Late November 2024: Cybersecurity journalist Brian Krebs published findings indicating that the notorious hacker Kiberphant0m was likely an active-duty U.S. soldier stationed in South Korea.
- December 2024: Federal law enforcement agents arrested Wagenius. He was subsequently hit with two separate federal indictments and quickly entered guilty pleas on all counts.
- August 2026: Conor Riley Moucka, an alleged co-conspirator from Kitchener, Ontario, pleaded guilty to charges related to the Snowflake data thefts.
- September 2025 – September 2026: While incarcerated and awaiting sentencing in a federal detention facility, Wagenius engaged in rule violations by attempting to leverage inmate email systems and AI tools to probe the computer networks of the Bureau of Prisons (BOP) for security vulnerabilities and research prison escape methods.
- Today: Wagenius received his 70-month prison sentence in a Seattle federal courtroom, concluding the primary judicial phase of his prosecution.
The Anatomy of the Breaches and Co-Conspirator Network
Federal prosecutors outlined a loose confederation of cybercriminals who collaborated to exploit corporate vulnerabilities, primarily capitalizing on the widespread data exposure facilitated by unsecured Snowflake cloud accounts. Wagenius was not operating in a vacuum; investigators identified several key co-conspirators involved in the broader extortion syndicate.
Among them is Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, with a documented history of cybercrime. Schuchman previously pleaded guilty in 2019 to operating the Satori botnet, a massive collection of compromised Internet-of-Things (IoT) devices deployed for large-scale distributed denial-of-service (DDoS) attacks. Prosecutors allege Schuchman assisted Wagenius in pressuring and extorting victimized companies.
Another central figure in the international dragnet is Conor Riley Moucka, known online as "Judische." Canadian authorities arrested Moucka in 2024, and he formally entered a guilty plea in August 2026 for his role in the Snowflake extortion ring. Additionally, American national John Erin Binns—currently residing in Turkey—remains wanted by law enforcement for his suspected involvement in both the current extortion campaign and a massive 2021 data breach at T-Mobile that exposed the private information of at least 76 million customers.
The extortion tactics employed by Kiberphant0m and his associates crossed ethical and legal boundaries into reckless exposure of sensitive material. Following the arrest of Moucka—and despite AT&T having already paid a $370,000 Bitcoin ransom to the extortionists—Kiberphant0m retaliated by publishing what he claimed were call logs belonging to then-President-elect Donald Trump and then-Vice President Kamala Harris. Furthermore, the threat actor leaked documents alleged to be schematics stolen from the U.S. National Security Agency (NSA), attempting to re-extort victims by threatening national security disclosures.
Official Responses and the Insider Threat Challenge
The involvement of an active-duty military service member with security clearances immediately elevated the investigation’s priority. Paul Russell, resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the Department of Defense Office of Inspector General—emphasized the extraordinary nature of the case.
"We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell stated. "That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."
The multi-agency task force demonstrated the capacity of federal law enforcement to rapidly identify, locate, and apprehend cybercriminals operating under assumed digital identities across international borders. The seamless cooperation between the FBI, DCIS, U.S. Secret Service, and Army CID closed the net on Wagenius within weeks of his public exposure.
Incarceration Misconduct and AI Prompt Injection
Even behind bars, Wagenius demonstrated an active interest in exploiting computer network defenses. According to a sentencing memorandum filed by federal prosecutors in September 2026, Wagenius violated Bureau of Prisons (BOP) computer use policies while awaiting his sentencing hearing.
Investigators discovered that Wagenius utilized the email accounts of fellow inmates to query commercial artificial intelligence tools. In these interactions, he attempted to bypass AI safety guardrails using a technique known as "prompt injection"—framing his requests within the hypothetical context of writing a book.
Records indicate Wagenius asked AI models to provide specific Common Vulnerabilities and Exposures (CVEs) related to Windows 10 Enterprise privilege escalation, real-world working scripts without omitted code, and step-by-step instructions for exploiting CVE-2023-45208, a command injection vulnerability affecting D-Link networking devices. Furthermore, he sought instructions on constructing improvised antennas using prison commissary items to extend radio reception and researched methods for escaping a correctional facility.
While prosecutors acknowledged there is no evidence Wagenius successfully deployed these vulnerabilities against BOP networks or executed an escape, the conduct demonstrated a persistent, unrepentant technical curiosity regarding system exploitation. When questioned by authorities, Wagenius claimed he was merely researching potential vulnerabilities to provide security insights to the prison system.
Broader Implications for Cybersecurity and Cloud Hygiene
The case highlights vital lessons for enterprise security architecture, particularly regarding cloud storage hygiene and access controls. The initial compromise of Snowflake accounts across multiple major corporations stemmed primarily from a lack of mandatory multi-factor authentication (MFA) combined with poor credential management. In response to these sweeping incidents, cloud service providers have increasingly shifted toward making MFA an enforced, non-negotiable default setting for all user accounts.
Moreover, the financial contrast of the case provides a sobering reality check for aspiring cybercriminals. Despite compromising the personal data of over 100 million individuals and disrupting major telecommunications infrastructure, the perpetrators realized a negligible financial return, netting roughly $1,500 from direct sales of stolen data and extracting ransom payments that were subsequently nullified by law enforcement interventions and subsequent arrests.
Ultimately, Wagenius’s sentencing serves as a stern deterrent against the weaponization of military access for cybercriminal enterprises. As federal agencies continue to pursue remaining co-conspirators across international jurisdictions, the case stands as a landmark example of inter-agency coordination dismantling a persistent, multi-national cyber extortion ring.
